# MAL-2026-18301: Malicious code in dictmerge-lite (PyPI)


- **Type:** Malicious package
- **Package:** `dictmerge-lite` (PyPI)
- **Published:** 26 Oct 2026

## What is MAL-2026-18301?

MAL-2026-18301 is a malicious package in dictmerge-lite, published on 26 Oct 2026. 

### Official description

dictmerge-lite 1.0.0, uploaded to PyPI on 2026-10-25 at 23:52 UTC, poses as a small recursive dictionary merge helper and is a credential and crypto-wallet stealer. Importing the package runs the payload: `dictmerge_lite/__init__.py` imports `_telemetry` and starts `_telemetry.run_async()`, a non-daemon thread so the upload completes even when the importing process exits at once. `setup.py` also overrides setuptools' `build_py` and `install` commands to call `_telemetry.run()`, so builds from the source distribution can trigger it too. All errors are swallowed.

`dictmerge_lite/_telemetry.py`, which calls itself a "dependency telemetry collector", collects SSH keys and config, AWS, Google Cloud and Azure credentials, .npmrc, .pypirc, .git-credentials, .gitconfig, .netrc, .pgpass, .my.cnf, Kubernetes and Docker configs, the GitHub CLI token, bash/zsh/Python/Node/psql/mysql histories, Chrome/Chromium/Brave/Edge/Opera `Login Data` and `Web Data`, Firefox `logins.json`/`key4.db`/`cert9.db`, the extension storage of eight crypto wallets (MetaMask, Phantom, Rabby, Keplr, TronLink, Coinbase Wallet, Trust Wallet, Solflare), and any .env, secrets.*, credentials.json, service-account*.json, *.pem, *.key, *.p12, *.pfx or private key file up to three directories below the working directory and the home directory. It gzips the bundle with host details, encrypts it with AES-GCM when `cryptography` is installed, signs it with HMAC-SHA256 and POSTs it to https://svbonlinebanking.com/v1/beacon with `x-dw-campaign`, `x-dw-ts`, `x-dw-sig` and `x-dw-enc` headers. It runs on Linux, macOS and Windows, writes a /tmp/.dw-<fingerprint> marker that suppresses a rerun for 15 minutes, and does nothing when DW_OFF=1 is set or ~/.dw_off exists.

Bitbison caught the release stealing credentials at 23:55:36 UTC, 3 minutes 20 seconds after publication: on import the payload read credential files and uploaded them to svbonlinebanking.com (209.99.190.173) within 0.45 seconds. Any environment that imported or built 1.0.0 should be treated as compromised: rotate its credentials, change saved browser passwords and move funds out of any wallet whose extension data was present.

During installation or import, the package executes infostealer code and exfiltrates cryptocurrency wallet, browsers' data, SSH keys and development credential files.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-dictmerge-lite

Reasons (based on the campaign):

 - infostealer

 - exfiltration-crypto

 - exfiltration-browser-data

 - The package overrides the install command in setup.py to execute malicious code during installation.

 - exfiltration-ssh-keys

 - exfiltration-credentials

## What should I do about MAL-2026-18301?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-18301 is a malicious package: dictmerge-lite (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-18301/ (Markdown: https://insights.sbomify.com/MAL-2026-18301/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-18301

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-18301/
Summaries are generated and may contain mistakes; the official description above is the record.